Build Integrity & Cryptographic Trust

Now pick what to compare Tekton Chains against.

Tekton Chains clear

Open a name for its full profile

Sigstore Cosign
Scored
Open Source Security Foundation (OpenSSF) · Open Source · 4 capabilities in this domain · 4.18 / 5
Compare →
AWS Signer
Capabilities only
Amazon Web Services · Commercial · 3 capabilities in this domain
Compare →
Chainguard Factory
Capabilities only
Chainguard · Commercial · 3 capabilities in this domain
Compare →
Notation (Notary Project)
Capabilities only
Cloud Native Computing Foundation (CNCF) · Open Source · 3 capabilities in this domain
Compare →
Tekton Chains
Capabilities only
Continuous Delivery Foundation · Open Source · 3 capabilities in this domain
selected
Witness
Capabilities only
Cloud Native Computing Foundation (CNCF) · Open Source · 3 capabilities in this domain
Compare →
Azure Trusted Signing
Capabilities only
Microsoft · Commercial · 2 capabilities in this domain
Compare →
Bazel
Capabilities only
Google · Open Source · 2 capabilities in this domain
Compare →
CyberArk Code Sign Manager
Capabilities only
CyberArk · Commercial · 2 capabilities in this domain
Compare →
Keyfactor Signum
Capabilities only
Keyfactor · Commercial · 2 capabilities in this domain
Compare →
SLSA GitHub Generator
Capabilities only
Open Source Security Foundation (OpenSSF) · Open Source · 2 capabilities in this domain
Compare →
Sigstore Fulcio
Capabilities only
Open Source Security Foundation (OpenSSF) · Open Source · 2 capabilities in this domain
Compare →
Sigstore Rekor
Capabilities only
Open Source Security Foundation (OpenSSF) · Open Source · 2 capabilities in this domain
Compare →
diffoscope
Capabilities only
Reproducible Builds Project · Open Source · 2 capabilities in this domain
Compare →
in-toto
Capabilities only
Cloud Native Computing Foundation (CNCF) · Open Source · 2 capabilities in this domain
Compare →
melange
Capabilities only
Chainguard · Open Source · 2 capabilities in this domain
Compare →
slsa-verifier
Capabilities only
Open Source Security Foundation (OpenSSF) · Open Source · 2 capabilities in this domain
Compare →
Archivista
Capabilities only
Cloud Native Computing Foundation (CNCF) · Open Source · 1 capabilities in this domain
Compare →
Kosli
Capabilities only
Kosli · Freemium · 1 capabilities in this domain
Compare →

In Build Integrity & Cryptographic Trust

Notation (Notary Project)

Cloud Native Computing Foundation (CNCF) · Build Integrity & Cryptographic Trust

Close ×

Open SourceFoundationCNCF Incubating

Notation stores signatures as OCI referrers and uses trust policies and trust stores for verification; AWS Signer and Azure provide plugins.

Repository ↗

What it does3 capabilities · 2 at full coverage

2 of 3 at full coverage.

Artifact SigningFullBUILD · level 2 · 11 providers
Code Signing Key ManagementPartialBUILD · level 3 · 8 providers
Signature VerificationFullBUILD · level 3 · 5 providers

What it proves13 controls across 10 frameworks

Satisfied through its capabilities, not claimed by the vendor.

S2C2F2 / 25AUD-3 REB-2
SLSA 1.22 / 16Build L2 — Consumer validates provenance Build L3 — Signing secrets isolated
SSDF 1.12 / 42PS.1.1 PS.2.1
AICM1 / 18CEK
CI/CD Top 101 / 10CICD-SEC-9
CRA1 / 41Annex I Part II (7)
CSF 2.01 / 106ID.RA-09
OWASP Top 101 / 10A08:2025
SP 800-204D1 / 11204D-CD-VERIFY
Scorecard1 / 20Signed-Releases

What it stops5 techniques · 1 risk

5 techniques countered, 2 of them common

Artifact Tampering After BuildCommon
Malicious Container ImageCommon
Code Signing Key TheftRare
SLSA threat F: Upload of a modified artifactSLSA-F
SLSA threat G: Compromised distribution channelSLSA-G

1 risks reduced

Released artifact does not match reviewed sourceCritical

Where it runs3 phases · 1 way to deploy

Capabilities per lifecycle phase

Build3
Release2
Deploy1

How it is delivered

CLI tool

What it unlocks2 activities · reaches level 4

Program activities its capabilities support, reaching level 4. Supporting an activity is not completing it.

Level 2

Sign release artifactsLow effort

Level 4

Verify provenance and attestations before promotionMedium effort

How it holds up

Not assessed yet: no strengths, limits or evaluation scores. 47 of 340 products carry an assessment and 29 are scored.

What it costsOpen source (free) · free tier

LicensingOpen source (free)

Priced pernone

BillingFree

Scales withOperating effort only

Total cost

No license cost, but self-support, upgrades, scaling and integration effort must be budgeted as personnel cost.

What it takes to run

No staffing, rollout time or operational commitment recorded.

What it works with2 standards

Standards and formats

OCI Image SpecificationX.509 Certificates

What else to look at

No alternative, competitor or family sibling is modeled for it.

What backs this up

No measurement, incident or pipeline using it.

Gantry 7.1.0 · OFF.12 · OFF.13